Is there a patch available for EUVD-2026-34086?

Yes, a patch is available for EUVD-2026-34086. Update the affected software to the latest version immediately.

Django EUVD-2026-34086

Q: What is the CVSS score of EUVD-2026-34086?

EUVD-2026-34086 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-6873 LOW

Improper Verification of Cryptographic Signature (CWE-347)

2026-06-03 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92

GHSA-h7pc-vwp9-298g

Jwt Attack Code Injection Python

2.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 03, 2026 - 16:01 EUVD

Analysis Generated

Jun 03, 2026 - 14:32 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

12 pypi packages depend on django (12 direct, 0 indirect)

Ecosystem-wide dependent count for version 5.2.

DescriptionCVE.org

An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. django.http.HttpRequest.get_signed_cookie in Django uses a non-injective salt derivation (concatenating the cookie name and salt argument), which allows a remote attacker to use a cookie in a context different from the one where it was signed, via distinct (name, salt) pairs that produce the same concatenation. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Peng Zhou for reporting this issue.

AnalysisAI

Cookie context confusion in Django's signed cookie implementation allows a remote low-privileged attacker to substitute a cookie signed in one application context into a different context where a distinct (name, salt) pair produces the same concatenated string. Affected are Django 6.0 before 6.0.6 and Django 5.2 before 5.2.15; older unsupported series (5.0.x, 4.1.x, 3.2.x) were not evaluated but may also be affected. The real-world impact is limited to low-confidence data exposure (VC:L), with no public exploit identified at time of analysis, and the CVSS 4.0 score of 2.3 reflects a low-severity, contextually constrained flaw.

Technical ContextAI

The vulnerability resides in django.http.HttpRequest.get_signed_cookie, part of Django's cryptographic cookie-signing subsystem (CPE: cpe:2.3:a:djangoproject:django:*). Django signs cookies using HMAC with a salt to bind a signed value to a specific purpose or context. The bug is that salt derivation is performed by naively concatenating the cookie name and the caller-supplied salt string - a non-injective function. Because concatenation of two strings is not uniquely reversible (e.g., name='ab', salt='cdef' produces the same string as name='abc', salt='def'), two completely distinct (name, salt) pairs can produce an identical HMAC key input. The root cause is classified as CWE-347 (Improper Verification of Cryptographic Signature): the signature itself may be cryptographically valid, but it is accepted in an unintended context because the domain-separation mechanism is broken. This is conceptually similar to JWT algorithm confusion or salt-reuse attacks in token systems, which explains the 'Jwt Attack' tag applied by the reporter.

RemediationAI

Upgrade to Django 6.0.6 or Django 5.2.15, which contain the vendor-released patch addressing the non-injective salt derivation. The fix is expected to introduce a separator or structurally distinct encoding between the cookie name and salt to ensure injectivity. Upgrade guidance and release notes are available at https://www.djangoproject.com/weblog/2026/jun/03/security-releases/ and security announcements at https://groups.google.com/g/django-announce. For deployments that cannot immediately upgrade, a targeted workaround is to audit all usages of get_signed_cookie in the application codebase and ensure no two (name, salt) pairs share the same concatenated string - for example, by enforcing a fixed-length cookie name prefix or using a delimiter character (such as ':') in the salt argument that cannot appear in cookie names. Note that this manual audit approach is error-prone and does not address the underlying library flaw; upgrading remains the only reliable remediation. Unsupported Django series (5.0.x and older) should be migrated to a supported branch as a priority.